Security Awareness: A Sound Business Strategy

Why Awareness Is Important

The behavior of employees with access to data affects information systems and assets. Employee and contractor behavior is the primary source of costly data breaches. It's also the best way to prevent loss.

Security can't be guaranteed. As Clint Eastwood once said, "If you want a guarantee, buy a toaster." The only secure system is one that's unplugged, turned off, and in a locked room.

Since it's not practical to leave our systems turned off, we need to understand the risks to our systems and prepare ourselves to defend them. Preparation begins with understanding — and that's where awareness comes in.

With all the news stories about hackers, botnets, and breaches involving personal information, it's easy for the security message to sound over-used and tired. It's easy for people to say, "It won't happen here." Yet, studies and surveys repeatedly show that: the human factor (what employees do or don't do) is the biggest threat to information systems and assets.

The best way to achieve a significant and lasting improvement in information security is not by throwing more technical solutions at the problem — it's by raising awareness and training and educating everyone who interacts with computer networks, systems, and information in the basics of information security.

National Institute of Standards and Technology (NIST) SP 800-53 also says that the awareness program must comply with: 5 Code of Federal Regulations (C.F.R.) Part 930.301 and NIST SP 800-50, Building an Information Technology Security Awareness and Training Program.

5 C.F.R. Part 930.301 states that everyone must receive initial awareness training before accessing systems and refresher training at least annually. It defines 5 specific roles that must receive awareness training:

The NIST Guide for Developing Security Plans for Information Technology Systems states that plans should include the:

Type and frequency of application-specific training provided to employees and contractors,

Type and frequency of general support system training provided to employees and contractors, and

Procedures for assuring that employees and contractors are adequately trained.

OMB Circular A-130, Appendix III, requires that system users receive security awareness instruction prior to being granted access to the system, and it requires periodic refresher training for continued access.

The NIST Computer Security Handbook cites the importance of managers to understand security consequences and costs so that they can factor security into their decisions.